CVE-2026-90893
Received Received - Intake

Cross-Site Request Forgery in MISP User Settings

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: CIRCL

Description
MISP contains a Cross-Site Request Forgery (CSRF) vulnerability in the UserSettingsController. The actions setTheme, setHomePage, and eventIndexColumnToggle were explicitly added to the Security component's unlockedActions list, which disabled all CSRF validation (both token and field-hash checks) for those endpoints. Because these endpoints accept POST requests and modify per-user application state (theme selection, default homepage URL, and event index column visibility), an attacker who can induce a logged-in MISP user to load a malicious page (e.g., via a crafted link, embedded image, or auto-submitting form) can forge requests that alter the victim's settings without their knowledge or consent. The most impactful action is setHomePage, which allows an attacker to redirect the victim's default landing page to an arbitrary attacker-controlled URL, potentially facilitating phishing or further social engineering. The setTheme action can alter the user's visual theme, and eventIndexColumnToggle can change which columns are displayed in the event index view. No authentication bypass is involved; the victim must already be authenticated to MISP. The vulnerability was reported by the Scottish Government National Cyber Team. Version affected: ≤2.5.45

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-90893
EUVD
EUVD-2026-77341

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
misp misp to 2.5.45 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Cross-Site Request Forgery (CSRF) flaw in MISP where certain user settings endpoints were improperly exposed. The actions setTheme, setHomePage, and eventIndexColumnToggle had CSRF validation disabled, allowing attackers to forge requests that modify a user's theme, default homepage, or event index column visibility without their consent.

Detection Guidance

To detect this vulnerability, check if your MISP instance is running a version ≤2.5.45. Inspect network traffic for POST requests to /users/setTheme, /users/setHomePage, or /users/eventIndexColumnToggle without CSRF tokens. Review server logs for unauthorized changes to user settings like theme, homepage, or event index columns.

Impact Analysis

An attacker could trick a logged-in MISP user into loading a malicious page, which would then forge requests to change the victim's settings. The most severe impact is the ability to redirect the victim's default homepage to an attacker-controlled URL, enabling phishing or further social engineering attacks.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling unauthorized modifications to user settings in MISP. For GDPR, it may lead to unauthorized data access or processing if an attacker changes a user's homepage to a malicious site, potentially harvesting credentials or sensitive information. For HIPAA, it could allow unauthorized changes to user interfaces or data exposure if settings like theme or column visibility are altered, compromising data integrity or confidentiality.

Mitigation Strategies

Upgrade MISP to a version newer than 2.5.45 to apply the CSRF protection fix. Ensure all AJAX requests to user settings endpoints include the X-CSRF-Token header. Monitor for suspicious POST requests to the affected endpoints and review user settings for unauthorized changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90893. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart